What actually applies

Build the map yourself, because the summaries you will be handed were written to sell something. Pick an organisation, yours or a public one you can research, and answer three questions in writing. Which jurisdictions does it operate in or serve customers into? Which of its activities involve automated decisions about people, as opposed to automated text about things? And which sector rules already bind it that have nothing to do with AI, because financial, medical and employment rules usually bite first and harder than any AI-specific law. Then, for the two or three regimes that genuinely reach it, read the primary source. Not a vendor blog, not a summary deck, the actual text or the regulator's own timeline page. Write down what applies, from what date, to whom, with the article or section number beside each line. Where you are unsure, write unsure instead of guessing, because a governance document that quietly overstates is worse than one with visible gaps. Finish with a single page somebody without a legal background could act on.

The common failure is reading about AI regulation in general and producing a document that is true everywhere and useful nowhere. Governance is specific or it is decoration. The way out is to name the organisation first and let that narrow everything. The second failure is citing a consultancy summary because the primary text is dense. Read the dense thing. Being the person who has actually read it is most of this job.